<html>
<head><meta charset="utf-8"><title>unknown code Rust AM boundary · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html">unknown code Rust AM boundary</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="178005196"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178005196" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178005196">(Oct 12 2019 at 20:29)</a>:</h4>
<p><span class="user-mention" data-user-id="211871">@Hadrien Grasland</span> </p>
<blockquote>
<p>Using volatile loads and stores to engage in a data race on a *mut u8 which is only accessed via volatiles loads and stores and has no Rust references to it is okay, because this memory location does not interact with the Rust abstract machine and memory operations affecting it are therefore not subjected to the rules of said abstract machine.</p>
</blockquote>
<p>I'm not sure what you mean by "this memory location does not interact with the Rust abstract machine".</p>



<a name="178005257"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178005257" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178005257">(Oct 12 2019 at 20:30)</a>:</h4>
<p>E.g., if the memory behind the <code>*mut u8</code> is "owned" by Rust, e.g., because it was allocated by it, then accesses through the pointer do alter the state of the abstract machine</p>



<a name="178005273"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178005273" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178005273">(Oct 12 2019 at 20:31)</a>:</h4>
<p>OTOH if the pointer was obtained by Rust from some unknown code, and Rust never accesses it, then that sounds reasonable</p>



<a name="178005898"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178005898" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178005898">(Oct 12 2019 at 20:49)</a>:</h4>
<p>What I was trying to express is that under these conditions, hardware stores cannot cause any observable harm.</p>



<a name="178005964"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178005964" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178005964">(Oct 12 2019 at 20:51)</a>:</h4>
<p>But I need some more spec-friendly language to spell it out ;)</p>



<a name="178006014"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178006014" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> centril <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178006014">(Oct 12 2019 at 20:52)</a>:</h4>
<p>This reminds me of the notion of non-interference (from lang-sec / information-flow control)</p>



<a name="178006107"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178006107" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178006107">(Oct 12 2019 at 20:55)</a>:</h4>
<p>If I try to go into more details...</p>
<ol>
<li>If we restrict ourselves to loads and stores, as volatile does, only hardware stores may harm Rust. Hardware loads can safely be considered not to be observable by Rust (even if that's technically not 100% true).</li>
<li>A hardware store may only cause harm by writing an invalid value in memory that Rust can read or writing data at the wrong time according to Rust's data access protocol (e.g. reference aliasing rules, Rust-visible data race).</li>
</ol>



<a name="178006163"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178006163" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178006163">(Oct 12 2019 at 20:57)</a>:</h4>
<p>If the data has no validity invariant besides initialized-ness, then any value that hardware can write is fine. At the hardware level, un-initializing data in RAM by writing <code>mem::uninitialized()</code> to it is not possible (to the point where it would actually be interesting to see what a volatile store of that compiles down to in LLVM).</p>



<a name="178006220"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178006220" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178006220">(Oct 12 2019 at 20:58)</a>:</h4>
<p>If the data is only accessed via hardware loads (volatile or assembly), and accessible via raw pointer, then Rust's memory access protocol never really comes into play, as with pure raw pointer based access the only data access protocol restriction that remains at the Rust level is "no data race", and hardware loads and stores have their own semantic of a data race which "just" produces garbage data, which is fine by Rust as long as there's no data validity invariant to be upheld.</p>



<a name="178006230"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178006230" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178006230">(Oct 12 2019 at 20:59)</a>:</h4>
<p>No reference = no aliasing assumptions, no "dereferenceable" allowing auto-caching<br>
No non-volatile pointer accesses = all accesses have hardware load semantics, so Rust's load semantics don't come into play</p>



<a name="178006353"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178006353" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178006353">(Oct 12 2019 at 21:02)</a>:</h4>
<p>At least that's my theory. Now I need to do a 2-year postdoc in <span class="user-mention" data-user-id="120791">@RalfJ</span>'s team to see how well it holds :P</p>



<a name="178007396"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007396" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007396">(Oct 12 2019 at 21:32)</a>:</h4>
<p>lol^^</p>



<a name="178007408"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007408" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007408">(Oct 12 2019 at 21:33)</a>:</h4>
<blockquote>
<p>hardware loads and stores have their own semantic of a data race which "just" produces garbage data, which is fine by Rust as long as there's no data validity invariant to be upheld.</p>
</blockquote>
<p>unfortunately LLVM devs <a href="https://bugs.llvm.org/show_bug.cgi?id=42435" target="_blank" title="https://bugs.llvm.org/show_bug.cgi?id=42435">refuse to guarantee</a> things like "volatile loads can never return <code>undef</code>"</p>



<a name="178007453"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007453" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007453">(Oct 12 2019 at 21:34)</a>:</h4>
<p>so, while I could certainly imagine a spec of <code>volatile</code> where you are right, I don't dare say that that's what LLVM implements :(</p>



<a name="178007528"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007528" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007528">(Oct 12 2019 at 21:37)</a>:</h4>
<p>(also: oh no, now that long long volatile thread that lay dormant for some time is alive again and will be even harder to summarize, if/when some dares to take on that task^^)</p>



<a name="178007734"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007734" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007734">(Oct 12 2019 at 21:43)</a>:</h4>
<p>Meh. Nasty LLVM devs. You have to admit, it would be super-tempting to be able to process inline assembly, FFI and volatile under a single unified "hardware memory model and its interactions with Rust's memory model" framework.</p>
<p>Three difficult memory model problems addressed for the price of one!</p>



<a name="178007785"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007785" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007785">(Oct 12 2019 at 21:44)</a>:</h4>
<p>If we only allow unknown code to do what sound Rust code would be able to do, then we are already there</p>



<a name="178007800"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007800" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007800">(Oct 12 2019 at 21:45)</a>:</h4>
<p>The problem is people wanting to call unknown code that can do things that Rust cannot do <span aria-label="laughter tears" class="emoji emoji-1f602" role="img" title="laughter tears">:laughter_tears:</span></p>



<a name="178007807"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007807" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007807">(Oct 12 2019 at 21:45)</a>:</h4>
<p>Yeah, or writing an OS kernel in Rust.</p>



<a name="178007857"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007857" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007857">(Oct 12 2019 at 21:46)</a>:</h4>
<p>Low-level hardware generally doesn't care much about what languages think of as the right way to access memory.</p>



<a name="178007862"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007862" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007862">(Oct 12 2019 at 21:46)</a>:</h4>
<p>Unless your hardware is "valgrind"</p>



<a name="178007864"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007864" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007864">(Oct 12 2019 at 21:46)</a>:</h4>
<p>or something similar</p>



<a name="178007879"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007879" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007879">(Oct 12 2019 at 21:47)</a>:</h4>
<p>Truly, it would be nice if every CPU were like valgrind... but without the 30x slowdown.</p>



<a name="178007932"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007932" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007932">(Oct 12 2019 at 21:48)</a>:</h4>
<p>Jokes aside, I think that Rust can guarantee that volatile loads do not generate <code>undef</code> even if LLVM doesn't</p>



<a name="178007938"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007938" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007938">(Oct 12 2019 at 21:48)</a>:</h4>
<p>I'd be fine to defer fixing that LLVM bug until somebody hits it</p>



<a name="178007949"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007949" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007949">(Oct 12 2019 at 21:49)</a>:</h4>
<p>volatile and inline assembly are related but not the same though ;)</p>



<a name="178007950"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007950" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007950">(Oct 12 2019 at 21:49)</a>:</h4>
<p>In a hardware-specific way, that's trivial: just write a one-line inline assembly snippet with your favorite LOAD instruction.</p>



<a name="178007951"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007951" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007951">(Oct 12 2019 at 21:49)</a>:</h4>
<p>and FFI... together with xLTO I'm afraid this framework is not going to be any good for that</p>



<a name="178007952"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178007952" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178007952">(Oct 12 2019 at 21:49)</a>:</h4>
<p>In a portable way, that may be harder</p>



<a name="178008006"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008006" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008006">(Oct 12 2019 at 21:50)</a>:</h4>
<p>but yes, the better I (think I) understand volatile the more I think a variant of that can also be used for inline assembly</p>



<a name="178008013"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008013" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008013">(Oct 12 2019 at 21:50)</a>:</h4>
<p>and the framework for that even exists already, it's called "syscalls" or "externally observable events"</p>



<a name="178008018"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008018" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008018">(Oct 12 2019 at 21:51)</a>:</h4>
<p>I think we should group them all under that framework</p>



<a name="178008038"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008038" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008038">(Oct 12 2019 at 21:52)</a>:</h4>
<p>The question is still: what is unknown code allowed to do? I don't think the possibility of xLTO happening should affect the answer</p>



<a name="178008039"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008039" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008039">(Oct 12 2019 at 21:52)</a>:</h4>
<p>the hard part is bounding what the effect of a volatile / inline assembly can be <em>in terms of the Rust Abstract Machine</em> in a way that's actually both sound and useful</p>



<a name="178008085"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008085" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008085">(Oct 12 2019 at 21:52)</a>:</h4>
<p>I asked whether an <code>asm!</code> statement with a memory <code>clobber</code> is a data-race, and I wasn't joking there</p>



<a name="178008086"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008086" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008086">(Oct 12 2019 at 21:52)</a>:</h4>
<blockquote>
<p>I'd be fine to defer fixing that LLVM bug until somebody hits it</p>
</blockquote>
<p>I am doubtful we'd ever realize that this is the cause of the bug. It'll just be someone's Heisenbug and make their life miserable.</p>



<a name="178008099"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008099" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008099">(Oct 12 2019 at 21:53)</a>:</h4>
<blockquote>
<p>The question is still: what is unknown code allowed to do? I don't think the possibility of xLTO happening should affect the answer</p>
</blockquote>
<p>I'd like to keep FFI and xLTO out of the equation until we solved the "easier" cases^^</p>



<a name="178008103"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008103" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008103">(Oct 12 2019 at 21:53)</a>:</h4>
<blockquote>
<p>I asked whether an <code>asm!</code> statement with a memory <code>clobber</code> is a data-race, and I wasn't joking there</p>
</blockquote>
<p>yeah it's a good question ;)</p>



<a name="178008149"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008149" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008149">(Oct 12 2019 at 21:54)</a>:</h4>
<p>it goes back to another issue I have with the C++ memory model: it's definition of a data race is utterly broken</p>



<a name="178008156"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178008156" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178008156">(Oct 12 2019 at 21:54)</a>:</h4>
<p>I think we need an <em>operational</em> model to make sense of all of that</p>



<a name="178027446"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027446" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027446">(Oct 13 2019 at 08:23)</a>:</h4>
<p>So... I have another question on this topic.</p>



<a name="178027452"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027452" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027452">(Oct 13 2019 at 08:23)</a>:</h4>
<p>What if we defined Rust's volatile to compile down to LLVM's atomic volatile with Relaxed or Unordered ordering?</p>



<a name="178027514"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027514" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027514">(Oct 13 2019 at 08:25)</a>:</h4>
<p>As far as I know, this would change almost nothing from a codegen point of view (since volatile loads and stores already cannot be eliminated or reordered).</p>



<a name="178027564"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027564" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027564">(Oct 13 2019 at 08:26)</a>:</h4>
<p>But it would have the interesting side-effect of making data races of volatile accesses on the Rust side well-defined.</p>



<a name="178027578"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027578" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027578">(Oct 13 2019 at 08:27)</a>:</h4>
<p>(Since they wouldn't be data races anymore from LLVM's point of view, and rustc itself never cared either way)</p>



<a name="178027687"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027687" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027687">(Oct 13 2019 at 08:31)</a>:</h4>
<p>As for the use case of sharing memory with untrusted code, data races of atomic reads with non-atomic writes would remain UB from a specification point of view... but on any platform that I am aware of, this UB could have no observable consequence, as long as the compiler never does LTO between the untrusted code and the trusted code (and doing that could go wrong in plenty of other ways, so security-conscious people just won't)</p>



<a name="178027740"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027740" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027740">(Oct 13 2019 at 08:33)</a>:</h4>
<p>I guess my question is, if volatile is meant to mean "defer to hardware semantics", and the semantics of all known hardware guarantees Relaxed atomics-like semantics on loads and store... do we really gain anything by using non-atomic volatile accesses?</p>



<a name="178027792"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027792" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027792">(Oct 13 2019 at 08:34)</a>:</h4>
<p>Given volatile's restrictions, is there really any optimization that LLVM can perform on non-atomic volatile accesses, that it cannot perform on atomic volatile accesses?</p>



<a name="178027801"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027801" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027801">(Oct 13 2019 at 08:35)</a>:</h4>
<p>Do we really care about LLVM's weird notion of racey volatile accesses, or could we just do without by telling LLVM to shut up and consider "our" volatile to be a strict superset of relaxed atomic?</p>



<a name="178027849"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027849" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027849">(Oct 13 2019 at 08:36)</a>:</h4>
<p>There is admittedly one backwards compatibility wrinkle: Making volatile atomic would break compilation of volatile accesses larger than pointer-sized. Many would argue that this is actually desirable. But breaking backwards compatibility is never okay.</p>



<a name="178027900"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027900" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027900">(Oct 13 2019 at 08:38)</a>:</h4>
<p>To address this, we would probably need to add ptr::read_atomic_volatile(), as opposed to changing ptr::read_volatile()'s semantics. Which would, as an extra benefit, allow us to add an Ordering parameter.</p>



<a name="178027915"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027915" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027915">(Oct 13 2019 at 08:39)</a>:</h4>
<p>After that, if everyone agrees with me that non-atomic volatile is a footgun, we could _consider_ deprecating it... But we don't really have to, we can just add a note on non-atomic volatile's documentation suggesting use of atomic volatile in concurrent scenarios.</p>



<a name="178027968"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178027968" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178027968">(Oct 13 2019 at 08:41)</a>:</h4>
<p>(OTOH, defaulting to relaxed/unordered volatile semantics would be the right choice in the case of inline assembly, where there's no room for an atomic ordering parameter in the syntax and hardware doesn't allow non-native-width load/store anyhow)</p>



<a name="178028092"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028092" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028092">(Oct 13 2019 at 08:45)</a>:</h4>
<p>One issue might be if there were some <em>very hypothetical</em> platform where (a) relaxed atomics use a different instruction from normal accesses and (b) MMIO accesses want the normal instruction.</p>



<a name="178028155"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028155" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028155">(Oct 13 2019 at 08:47)</a>:</h4>
<p>That would mean a multiprocessor platform without guaranteed cache coherence... ew, poor devs.</p>



<a name="178028206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028206">(Oct 13 2019 at 08:48)</a>:</h4>
<p>But such a use case could be served by not deprecating read_volatile/write_volatile, and instead warning people that these are aimed at very niche scenarios and should not be used as their everyday tool, even for MMIO.</p>



<a name="178028313"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028313" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028313">(Oct 13 2019 at 08:52)</a>:</h4>
<p>condition A might be satisfied by VMs such as WebAssembly... I took a quick look but I can't figure out exactly what they're guaranteeing about data races</p>



<a name="178028343"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028343" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028343">(Oct 13 2019 at 08:52)</a>:</h4>
<p>but then WebAssembly has no MMIO</p>



<a name="178028435"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028435" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028435">(Oct 13 2019 at 08:55)</a>:</h4>
<p>It does have I/O with the host platform, that's what hsivonen had in mind when starting this topic many months ago... but that form of MMIO is not picky about the exact choice of hardware instruction ;)</p>



<a name="178028507"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028507" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028507">(Oct 13 2019 at 08:57)</a>:</h4>
<p>by the way, one fun thing about volatile with memory orderings</p>



<a name="178028509"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028509" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028509">(Oct 13 2019 at 08:57)</a>:</h4>
<p>on some platforms, there is more than one way to implement atomics in terms of barriers <a href="https://www.cl.cam.ac.uk/~pes20/cpp/cpp0xmappings.html" target="_blank" title="https://www.cl.cam.ac.uk/~pes20/cpp/cpp0xmappings.html">https://www.cl.cam.ac.uk/~pes20/cpp/cpp0xmappings.html</a></p>



<a name="178028554"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028554" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028554">(Oct 13 2019 at 08:58)</a>:</h4>
<p>if you're using it for IPC in shared memory... in theory the process you're communicating with could be using a different choice</p>



<a name="178028562"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028562" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028562">(Oct 13 2019 at 08:58)</a>:</h4>
<p>(it probably won't be, since it's part of the ABI and other processes are probably not using a different ABI, but you never know <em>shrug</em>)</p>



<a name="178028573"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028573" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028573">(Oct 13 2019 at 08:59)</a>:</h4>
<p>You're right! In that case, it would probably make more sense to only allow relaxed and unordered ordering on atomic volatile.</p>



<a name="178028582"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028582" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028582">(Oct 13 2019 at 08:59)</a>:</h4>
<p>...that said, I have actual use cases for atomics in shared memory with non-relaxed orderings</p>



<a name="178028633"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028633" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028633">(Oct 13 2019 at 09:00)</a>:</h4>
<p>so I have no idea what the best policy is :p</p>



<a name="178028642"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028642" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028642">(Oct 13 2019 at 09:00)</a>:</h4>
<p>Probably start with Relaxed, and consider adding other memory barriers as a later step.</p>



<a name="178028663"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028663" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028663">(Oct 13 2019 at 09:01)</a>:</h4>
<p>perhaps</p>



<a name="178028666"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028666" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028666">(Oct 13 2019 at 09:01)</a>:</h4>
<p>We don't really need to solve the problem of defining an ABI for atomic memory barriers urgently, I think.</p>



<a name="178028714"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028714" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028714">(Oct 13 2019 at 09:02)</a>:</h4>
<p>And that would likely entail quite a bit of extra work, e.g. getting it engraved in the SYSV ABI for example.</p>



<a name="178028719"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028719" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028719">(Oct 13 2019 at 09:02)</a>:</h4>
<p>it's already part of the ABI, isn't it?  you can link together multiple C programs that use C11 atomics</p>



<a name="178028730"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028730" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028730">(Oct 13 2019 at 09:02)</a>:</h4>
<p>although I don't know if it's literally specified in the document</p>



<a name="178028735"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028735" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028735">(Oct 13 2019 at 09:03)</a>:</h4>
<p>Actually, that's an excellent point. I have no idea how that works.</p>



<a name="178028739"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028739" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028739">(Oct 13 2019 at 09:03)</a>:</h4>
<p>it's just that in general, a process you're communicating with over IPC may not be something you could link with</p>



<a name="178028743"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028743" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> comex <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028743">(Oct 13 2019 at 09:03)</a>:</h4>
<p>that said, this is usually an issue only for SeqCst (although I can't say it couldn't theoretically apply to other orderings)</p>



<a name="178028892"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028892" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028892">(Oct 13 2019 at 09:07)</a>:</h4>
<p>One potentially interesting middle ground could be to treat non-Relaxed atomics in shared memory like any other repr(Rust) concern: we only guarantee that it works when linking two binaries produced by the same version of rustc and in the same configuration.</p>



<a name="178028903"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178028903" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178028903">(Oct 13 2019 at 09:07)</a>:</h4>
<p>Not sure how that idea translates into standardese, tho</p>



<a name="178032244"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178032244" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178032244">(Oct 13 2019 at 10:23)</a>:</h4>
<p>If we map Rust atomics to C11 atomics we can just provide the guarantees when libc is linked</p>



<a name="178032311"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178032311" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178032311">(Oct 13 2019 at 10:24)</a>:</h4>
<p>e.g. "if all processes involved in the IPC use the same ABI"/"libc", then...</p>



<a name="178033072"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown%20code%20Rust%20AM%20boundary/near/178033072" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hadrien Grasland <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/unknown.20code.20Rust.20AM.20boundary.html#178033072">(Oct 13 2019 at 10:45)</a>:</h4>
<p>I posted some report of this discussion at <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/152" target="_blank" title="https://github.com/rust-lang/unsafe-code-guidelines/issues/152">https://github.com/rust-lang/unsafe-code-guidelines/issues/152</a> with a link back here for extra visibility.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>